CVE-2026-49454

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49454", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-30T02:43:33.107Z", "datePublished": "2026-06-18T20:52:22.605Z", "dateUpdated": "2026-06-22T15:51:42.595Z"}, "containers": {"cna": {"title": "Relyra SAML SignatureValue not cryptographically verified -> authentication bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/szTheory/relyra/security/advisories/GHSA-jv46-xfwm-36j7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/szTheory/relyra/security/advisories/GHSA-jv46-xfwm-36j7"}, {"name": "https://github.com/szTheory/relyra/commit/2e456897af3158c175bb490ce7fc51d6241c8922", "tags": ["x_refsource_MISC"], "url": "https://github.com/szTheory/relyra/commit/2e456897af3158c175bb490ce7fc51d6241c8922"}, {"name": "https://github.com/szTheory/relyra/commit/8910200", "tags": ["x_refsource_MISC"], "url": "https://github.com/szTheory/relyra/commit/8910200"}], "affected": [{"vendor": "szTheory", "product": "relyra", "versions": [{"version": ">= 1.0.0, < 1.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-18T20:52:22.605Z"}, "descriptions": [{"lang": "en", "value": "Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0.0 and 1.1.0 accept forged SAML signatures because SignatureValue was not cryptographically verified before the library returned a successful authentication result. The XMLDSig trust boundary was incomplete as :public_key.verify over the exclusive-C14N canonicalized SignedInfo was not performed against the configured IdP certificate's public key, DigestValue was not recomputed over the canonicalized referenced element, and canonicalize/2 remained an unused passthrough in the signature-verification path. The result was a structure-only acceptance path where document shape and trust-source rejection could succeed without proving the signature bytes. A forged SignatureValue carrying an attacker-controlled NameID could be accepted as {:ok}. This issue has been fixed in version 1.2.0."}], "source": {"advisory": "GHSA-jv46-xfwm-36j7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T15:50:42.585285Z", "id": "CVE-2026-49454", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T15:51:42.595Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49454", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T15:50:42.585285Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T15:51:10.767Z"}}], "cna": {"title": "Relyra SAML SignatureValue not cryptographically verified -> authentication bypass", "source": {"advisory": "GHSA-jv46-xfwm-36j7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "szTheory", "product": "relyra", "versions": [{"status": "affected", "version": ">= 1.0.0, < 1.2.0"}]}], "references": [{"url": "https://github.com/szTheory/relyra/security/advisories/GHSA-jv46-xfwm-36j7", "name": "https://github.com/szTheory/relyra/security/advisories/GHSA-jv46-xfwm-36j7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/szTheory/relyra/commit/2e456897af3158c175bb490ce7fc51d6241c8922", "name": "https://github.com/szTheory/relyra/commit/2e456897af3158c175bb490ce7fc51d6241c8922", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/szTheory/relyra/commit/8910200", "name": "https://github.com/szTheory/relyra/commit/8910200", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0.0 and 1.1.0 accept forged SAML signatures because SignatureValue was not cryptographically verified before the library returned a successful authentication result. The XMLDSig trust boundary was incomplete as :public_key.verify over the exclusive-C14N canonicalized SignedInfo was not performed against the configured IdP certificate's public key, DigestValue was not recomputed over the canonicalized referenced element, and canonicalize/2 remained an unused passthrough in the signature-verification path. The result was a structure-only acceptance path where document shape and trust-source rejection could succeed without proving the signature bytes. A forged SignatureValue carrying an attacker-controlled NameID could be accepted as {:ok}. This issue has been fixed in version 1.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-18T20:52:22.605Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49454", "state": "PUBLISHED", "dateUpdated": "2026-06-22T15:51:42.595Z", "dateReserved": "2026-05-30T02:43:33.107Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-18T20:52:22.605Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "relyra", "vendor": "szTheory", "versions": [{"status": "affected", "version": ">= 1.0.0, < 1.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0.0 and 1.1.0 accept forged SAML signatures because SignatureValue was not cryptographically verified before the library returned a successful authentication result. The XMLDSig trust boundary was incomplete as :public_key.verify over the exclusive-C14N canonicalized SignedInfo was not performed against the configured IdP certificate's public key, DigestValue was not recomputed over the canonicalized referenced element, and canonicalize/2 remained an unused passthrough in the signature-verification path. The result was a structure-only acceptance path where document shape and trust-source rejection could succeed without proving the signature bytes. A forged SignatureValue carrying an attacker-controlled NameID could be accepted as {:ok}. This issue has been fixed in version 1.2.0."}, {"lang": "es", "value": "Relyra es una biblioteca de proveedor de servicios SAML 2.0 estricta por defecto para Elixir y Phoenix. Las versiones 1.0.0 y 1.1.0 aceptan firmas SAML falsificadas porque SignatureValue no fue verificado criptogr\u00e1ficamente antes de que la biblioteca devolviera un resultado de autenticaci\u00f3n exitoso. El l\u00edmite de confianza de XMLDSig estaba incompleto ya que :public_key.verify sobre el SignedInfo canonizado exclusive-C14N no se realiz\u00f3 contra la clave p\u00fablica del certificado IdP configurado, DigestValue no se volvi\u00f3 a calcular sobre el elemento referenciado canonizado, y canonicalize/2 permaneci\u00f3 como un passthrough sin usar en la ruta de verificaci\u00f3n de firma. El resultado fue una ruta de aceptaci\u00f3n solo por estructura donde la forma del documento y el rechazo de la fuente de confianza pod\u00edan tener \u00e9xito sin probar los bytes de la firma. Un SignatureValue falsificado que conten\u00eda un NameID controlado por el atacante pod\u00eda ser aceptado como {:ok}. Este problema ha sido solucionado en la versi\u00f3n 1.2.0."}], "id": "CVE-2026-49454", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49454", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T15:50:42.585285Z", "version": "2.0.3"}}]}, "published": "2026-06-18T21:16:29.920", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/szTheory/relyra/commit/2e456897af3158c175bb490ce7fc51d6241c8922"}, {"source": "security-advisories@github.com", "url": "https://github.com/szTheory/relyra/commit/8910200"}, {"source": "security-advisories@github.com", "url": "https://github.com/szTheory/relyra/security/advisories/GHSA-jv46-xfwm-36j7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "relyra", "source": "cna", "vendor": "szTheory"}, "product": "relyra", "vendor": "sztheory"}], "created": "2026-06-18T22:30:16.765180+00:00", "updated": "2026-06-20T22:55:42.311576+00:00", "vendors": ["sztheory", "sztheory$PRODUCT$relyra"]}